Even more on Correlation IDs within SharePoint 2010

I briefly talked about log correlation IDs in two previous posts (More on Correlation IDs in SharePoint 2010 and The SharePoint 2010 Developer Dashboard), and am also including a bit from yet another post (Diagnostic Logging Enhancements in SharePoint 2010). When you get to an error page in SharePoint 2010, you are now presented with a Correlation ID. Basically, this is just expanding upon Wictor Wilén’s post here: Working with SharePoint 2010 Correlation ID in PowerShell and code. I basically just want to flesh these out a bit, and ways to get at the errors you are looking for.

Using our Boston Area SharePoint Users Group website as an example – we don’t have search configured yet on the new site, however, we have the search box available currently (we’ll fix it, I swear!). Running a search produces the following error message:



Straight, and to the point. While about as useless as your regular everyday SharePoint error, you get a pretty icon, but, more importantly, you get a correlation ID. Now, let’s see what we get using the Get-SPLogEvent PowerShell command mentioned in Wictor’s article…

So, I am running the following command –

   1: Get-SPLogEvent | ?{$_.Correlation -eq "41e7b6f1-ac66-4a16-87c0-18a85ad13f21"} | ft Category, Message -Autosize

And it’ll take a few moments, as it has a LOT of log entries to run through…


So, let’s take a step back. Now, this is NOT SUPPORTED BY MICROSOFT, at least as far as I know. So, don’t do it. ever. really. They’ll find you. This may change however once the RTM copy hits the shelves, and it is available at Target stores world-wide. Once it is released, then we’ll be able to find out all of what is and what is not supported.

But let’s say, for the sake of argument, I want to find those log entries fast, and, as luck would have it, I am also the resident SQL DBA, so, I have access to the SharePoint databases on the farm’s SQL server.

Take a look at the WSS_Logging database. Specifically, at the ULSTraceLog view. Notice in there, that there is a column named CorrelationId? Well kids, that means we can do a direct SQL search for it, in addition to the handy PowerShell Get-SPLogEvent command, as well as the code-based approach Wictor outlined in his post!

   1: SELECT * 
   2: FROM WSS_Logging.dbo.ULSTraceLog
   3: WHERE CorrelationId = '41e7b6f1-ac66-4a16-87c0-18a85ad13f21'

This, as you may notice if you also try, this will take a few moments, depending on the size of your logs, but, what I have noticed, is that it runs far quicker than the Get-SPLogEvent PowerShell command.


So, in short, if you need a completely unsupported way to quickly get to your logs by using your CorrelationId, there is a faster way than viewing and searching through the ULS text logs on the file system, or using the Get-SPLogEvent PowerShell cmdlet.

I have not run actual timing tests on these, these are just from personal experience. Maybe one day I will get around to that…



About Geoff Varosky
Geoff Varosky is a Senior Architect for Insight, based out of Watertown, MA. He has been architecting and developing web based applications his entire career, and has been working with SharePoint for the past 15 years. Geoff is an active member of the SharePoint community, Co-Founder and Co-Organizer of the Boston Area SharePoint Users Group, co-founder for the Boston Office 365 Users Group, co-organizer for SharePoint Saturday Boston and speaks regularly at SharePoint events and user groups.

One Response to Even more on Correlation IDs within SharePoint 2010

  1. Craig says:

    To increase the speed you can use the -starttime and -endtime parameters to the Get-SPLogEvent command.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: